io.codemodder.codemods.sanitize-spring-multipart-filename.yaml Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of core-codemods Show documentation

Codemods for fixing common errors across many Java projects

There is a newer version: 0.97.3

rules:
  - id: sanitize-spring-multipart-filename
    mode: taint
    metadata:
      options:
        symbolic_propagation: true
    pattern-sources:
      - pattern: (org.springframework.web.multipart.MultipartFile $X).getOriginalFilename()
      - pattern: (MultipartFile $X).getOriginalFilename()
    pattern-sanitizers:
      - pattern-either:
          - pattern: Filenames.toSimpleFileName(...)
    pattern-sinks:
      - patterns:
          - pattern-either:
              - pattern: |
                  new $F(...,<... $SINK ...>)
              - pattern: |
                  $F(<... $SINK ...>)
              - pattern: |
                  return $SINK;
    message: Semgrep found a match
    languages:
      - java
    severity: WARNING